[picketlink-commits] Picketlink SVN: r1068 - in federation/trunk/picketlink-fed-core/src/main: java/org/picketlink/identity/federation/core/saml/v1/providers and 3 other directories.

Wednesday, 6 July 2011

Author: anil.saldhana(a)jboss.com
Date: 2011-07-06 11:29:51 -0400 (Wed, 06 Jul 2011)
New Revision: 1068

Added:
 
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/providers/
 
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/providers/SAML11AssertionTokenProvider.java
Removed:
 
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/plugins/saml/SAML11TokenProvider.java
Modified:
 
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/SAML11Constants.java
 
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/SAML11ProtocolContext.java
 
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/util/AssertionUtil.java
 federation/trunk/picketlink-fed-core/src/main/resources/core-sts.xml
Log:
PLFED-189:

Modified:
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/SAML11Constants.java
===================================================================
---
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/SAML11Constants.java	2011-07-06
14:45:20 UTC (rev 1067)
+++
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/SAML11Constants.java	2011-07-06
15:29:51 UTC (rev 1068)
@@ -52,6 +52,14 @@
 
 String AUTHENTICATION_METHOD = "AuthenticationMethod";
 
+ String AUTH_METHOD_PASSWORD = "urn:oasis:names:tc:SAML:1.0:am:password";
+
+ String AUTH_METHOD_KERBEROS = "urn:ietf:rfc:1510";
+
+ String AUTH_METHOD_SRP = "urn:ietf:rfc:2945";
+
+ String AUTH_METHOD_TLS = "urn:ietf:rfc:2246";
+
 String AUTHENTICATION_QUERY = "AuthenticationQuery";
 
 String AUTHENTICATION_STATEMENT = "AuthenticationStatement";

Modified:
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/SAML11ProtocolContext.java
===================================================================
---
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/SAML11ProtocolContext.java	2011-07-06
14:45:20 UTC (rev 1067)
+++
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/SAML11ProtocolContext.java	2011-07-06
15:29:51 UTC (rev 1068)
@@ -59,6 +59,8 @@
 
 protected SAML11AssertionType issuedAssertion;
 
+ protected String authMethod = SAML11Constants.AUTH_METHOD_PASSWORD;
+
 /**
 * Get the Issuer ID
 * @return instance of {@link SAML11NameIdentifierType}
@@ -158,6 +160,25 @@
 }
 
 /**
+ * Get the Authentication Method
+ * @return
+ */
+ public String getAuthMethod()
+ {
+ return authMethod;
+ }
+
+ /**
+ * Set the Authentication Method.
+ * By default, it is set to urn:oasis:names:tc:SAML:1.0:am:password
+ * @param authMethod
+ */
+ public void setAuthMethod(String authMethod)
+ {
+ this.authMethod = authMethod;
+ }
+
+ /**
 * @see
org.picketlink.identity.federation.core.interfaces.ProtocolContext#serviceName()
 */
 public String serviceName()

Added:
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/providers/SAML11AssertionTokenProvider.java
===================================================================
---
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/providers/SAML11AssertionTokenProvider.java	
 (rev 0)
+++
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/providers/SAML11AssertionTokenProvider.java	2011-07-06
15:29:51 UTC (rev 1068)
@@ -0,0 +1,295 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2008, Red Hat Middleware LLC, and individual contributors
+ * as indicated by the @author tags. See the copyright.txt file in the
+ * distribution for a full listing of individual contributors. 
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.picketlink.identity.federation.core.saml.v1.providers;
+
+import java.io.IOException;
+import java.net.URI;
+import java.util.List;
+import java.util.Map;
+
+import javax.xml.datatype.XMLGregorianCalendar;
+import javax.xml.namespace.QName;
+
+import org.picketlink.identity.federation.core.exceptions.ConfigurationException;
+import org.picketlink.identity.federation.core.exceptions.ProcessingException;
+import org.picketlink.identity.federation.core.interfaces.ProtocolContext;
+import org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider;
+import org.picketlink.identity.federation.core.saml.v1.SAML11Constants;
+import org.picketlink.identity.federation.core.saml.v1.SAML11ProtocolContext;
+import org.picketlink.identity.federation.core.saml.v2.common.IDGenerator;
+import org.picketlink.identity.federation.core.saml.v2.common.SAMLProtocolContext;
+import org.picketlink.identity.federation.core.saml.v2.constants.JBossSAMLConstants;
+import
org.picketlink.identity.federation.core.saml.v2.exceptions.IssueInstantMissingException;
+import org.picketlink.identity.federation.core.saml.v2.util.AssertionUtil;
+import org.picketlink.identity.federation.core.saml.v2.util.XMLTimeUtil;
+import org.picketlink.identity.federation.core.sts.AbstractSecurityTokenProvider;
+import org.picketlink.identity.federation.core.sts.PicketLinkCoreSTS;
+import org.picketlink.identity.federation.saml.v1.assertion.SAML11AssertionType;
+import
org.picketlink.identity.federation.saml.v1.assertion.SAML11AuthenticationStatementType;
+import org.picketlink.identity.federation.saml.v1.assertion.SAML11NameIdentifierType;
+import org.picketlink.identity.federation.saml.v1.assertion.SAML11StatementAbstractType;
+import org.picketlink.identity.federation.saml.v1.assertion.SAML11SubjectType;
+import org.picketlink.identity.federation.saml.v2.assertion.AssertionType;
+
+/**
+ * 
+ * A {@code SecurityTokenProvider} implementation for the SAML11 Specification.
+ * 
+ * 
+ * This token provider does not handle the SAML20 Token Profile of the Oasis WS-Trust
Specification.
+ * @see {@code SAML20TokenProvider} 
+ * 
+ * 
+ * Configurable Properties are:
+ * 
+ * 
+ * ASSERTION_VALIDITY: specify the validity of the assertion in miliseconds. (Example:
5000 = 5secs)
+ * 
+ * 
+ * CLOCK_SKEW: specify the clock skew of the conditions for assertion in miliseconds.
(Example: 2000 = 2secs)
+ * 
+ * 
+ * @author Anil.Saldhana(a)redhat.com
+ * @since Dec 30, 2010
+ */
+public class SAML11AssertionTokenProvider extends AbstractSecurityTokenProvider
implements SecurityTokenProvider
+{
+ public static final String NS = SAML11Constants.ASSERTION_11_NSURI;
+
+ private long ASSERTION_VALIDITY = 5000; //5secs in milis
+
+ private long CLOCK_SKEW = 2000; //2secs
+
+ public void initialize(Map<String, String> props)
+ {
+ super.initialize(props);
+
+ String validity = this.properties.get("ASSERTION_VALIDITY");
+ if (validity != null)
+ {
+ ASSERTION_VALIDITY = Long.parseLong(validity);
+ }
+ String skew = this.properties.get("CLOCK_SKEW");
+ if (skew != null)
+ {
+ CLOCK_SKEW = Long.parseLong(skew);
+ }
+ }
+
+ /**
+ * @see
org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#supports(java.lang.String)
+ */
+ public boolean supports(String namespace)
+ {
+ return NS.equals(namespace);
+ }
+
+ /**
+ * @see
org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#issueToken(org.picketlink.identity.federation.core.interfaces.ProtocolContext)
+ */
+ public void issueToken(ProtocolContext context) throws ProcessingException
+ {
+ if (!(context instanceof SAML11ProtocolContext))
+ return;
+
+ SecurityManager sm = System.getSecurityManager();
+ if (sm != null)
+ sm.checkPermission(PicketLinkCoreSTS.rte);
+
+ SAML11ProtocolContext samlProtocolContext = (SAML11ProtocolContext) context;
+
+ SAML11NameIdentifierType issuerID = samlProtocolContext.getIssuerID();
+ XMLGregorianCalendar issueInstant;
+ try
+ {
+ issueInstant = XMLTimeUtil.getIssueInstant();
+ }
+ catch (ConfigurationException e)
+ {
+ throw new ProcessingException(e);
+ }
+ SAML11SubjectType subject = samlProtocolContext.getSubjectType();
+ List<SAML11StatementAbstractType> statements =
samlProtocolContext.getStatements();
+
+ // generate an id for the new assertion.
+ String assertionID = IDGenerator.create("ID_");
+
+ SAML11AssertionType assertionType = new SAML11AssertionType(assertionID,
issueInstant);
+ assertionType.setIssuer(issuerID.getValue());
+ assertionType.addAllStatements(statements);
+ try
+ {
+ AssertionUtil.createSAML11TimedConditions(assertionType, ASSERTION_VALIDITY,
CLOCK_SKEW);
+ }
+ catch (Exception e)
+ {
+ throw new ProcessingException(e);
+ }
+
+ //Create authentication statement
+ URI authenticationMethod = URI.create(samlProtocolContext.getAuthMethod());
+ SAML11AuthenticationStatementType stat = new
SAML11AuthenticationStatementType(authenticationMethod, issueInstant);
+ stat.setSubject(subject);
+ assertionType.add(stat);
+
+ try
+ {
+ this.tokenRegistry.addToken(assertionID, assertionType);
+ }
+ catch (IOException e)
+ {
+ throw new ProcessingException(e);
+ }
+ samlProtocolContext.setIssuedAssertion(assertionType);
+ }
+
+ /**
+ * @see
org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#renewToken(org.picketlink.identity.federation.core.interfaces.ProtocolContext)
+ */
+ public void renewToken(ProtocolContext context) throws ProcessingException
+ {
+ if (!(context instanceof SAMLProtocolContext))
+ return;
+
+ SecurityManager sm = System.getSecurityManager();
+ if (sm != null)
+ sm.checkPermission(PicketLinkCoreSTS.rte);
+
+ SAMLProtocolContext samlProtocolContext = (SAMLProtocolContext) context;
+
+ AssertionType issuedAssertion = samlProtocolContext.getIssuedAssertion();
+
+ try
+ {
+ XMLGregorianCalendar currentTime = XMLTimeUtil.getIssueInstant();
+ issuedAssertion.updateIssueInstant(currentTime);
+ }
+ catch (ConfigurationException e)
+ {
+ throw new ProcessingException(e);
+ }
+
+ try
+ {
+ AssertionUtil.createTimedConditions(issuedAssertion, ASSERTION_VALIDITY,
CLOCK_SKEW);
+ }
+ catch (ConfigurationException e)
+ {
+ throw new ProcessingException(e);
+ }
+ catch (IssueInstantMissingException e)
+ {
+ throw new ProcessingException(e);
+ }
+
+ try
+ {
+ this.tokenRegistry.addToken(issuedAssertion.getID(), issuedAssertion);
+ }
+ catch (IOException e)
+ {
+ throw new ProcessingException(e);
+ }
+ samlProtocolContext.setIssuedAssertion(issuedAssertion);
+ }
+
+ /** 
+ * @see
org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#cancelToken(org.picketlink.identity.federation.core.interfaces.ProtocolContext)
+ */
+ public void cancelToken(ProtocolContext context) throws ProcessingException
+ {
+ if (!(context instanceof SAMLProtocolContext))
+ return;
+
+ SecurityManager sm = System.getSecurityManager();
+ if (sm != null)
+ sm.checkPermission(PicketLinkCoreSTS.rte);
+
+ SAMLProtocolContext samlProtocolContext = (SAMLProtocolContext) context;
+ AssertionType issuedAssertion = samlProtocolContext.getIssuedAssertion();
+ try
+ {
+ this.tokenRegistry.removeToken(issuedAssertion.getID());
+ }
+ catch (IOException e)
+ {
+ throw new ProcessingException(e);
+ }
+ }
+
+ /**
+ * @see
org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#validateToken(org.picketlink.identity.federation.core.interfaces.ProtocolContext)
+ */
+ public void validateToken(ProtocolContext context) throws ProcessingException
+ {
+ if (!(context instanceof SAMLProtocolContext))
+ return;
+
+ SecurityManager sm = System.getSecurityManager();
+ if (sm != null)
+ sm.checkPermission(PicketLinkCoreSTS.rte);
+
+ SAMLProtocolContext samlProtocolContext = (SAMLProtocolContext) context;
+
+ AssertionType issuedAssertion = samlProtocolContext.getIssuedAssertion();
+
+ try
+ {
+ if (!AssertionUtil.hasExpired(issuedAssertion))
+ throw new ProcessingException("Assertion has expired");
+ }
+ catch (ConfigurationException e)
+ {
+ throw new ProcessingException(e);
+ }
+
+ if (issuedAssertion == null)
+ throw new ProcessingException("Assertion is null");
+ if (this.tokenRegistry.getToken(issuedAssertion.getID()) == null)
+ throw new ProcessingException("Invalid Assertion");
+ }
+
+ /**
+ *
+ * @see
org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#tokenType()
+ */
+ public String tokenType()
+ {
+ return NS;
+ }
+
+ /**
+ * @see
org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#getSupportedQName()
+ */
+ public QName getSupportedQName()
+ {
+ return new QName(NS, JBossSAMLConstants.ASSERTION.get());
+ }
+
+ /**
+ * @see
org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#family()
+ */
+ public String family()
+ {
+ return SecurityTokenProvider.FAMILY_TYPE.SAML2.toString();
+ }
+}
\ No newline at end of file


Property changes on:
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v1/providers/SAML11AssertionTokenProvider.java
___________________________________________________________________
Added: svn:executable
 + *

Modified:
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/util/AssertionUtil.java
===================================================================
---
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/util/AssertionUtil.java	2011-07-06
14:45:20 UTC (rev 1067)
+++
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/util/AssertionUtil.java	2011-07-06
15:29:51 UTC (rev 1068)
@@ -203,6 +203,30 @@
 }
 
 /**
+ * Add validity conditions to the SAML2 Assertion
+ * @param assertion
+ * @param durationInMilis 
+ * @throws ConfigurationException 
+ * @throws IssueInstantMissingException 
+ */
+ public static void createSAML11TimedConditions(SAML11AssertionType assertion, long
durationInMilis, long clockSkew)
+ throws ConfigurationException, IssueInstantMissingException
+ {
+ XMLGregorianCalendar issueInstant = assertion.getIssueInstant();
+ if (issueInstant == null)
+ throw new IssueInstantMissingException("null issue instant");
+ XMLGregorianCalendar assertionValidityLength = XMLTimeUtil.add(issueInstant,
durationInMilis + clockSkew);
+
+ SAML11ConditionsType conditionsType = new SAML11ConditionsType();
+
+ XMLGregorianCalendar beforeInstant = XMLTimeUtil.subtract(issueInstant,
clockSkew);
+
+ conditionsType.setNotBefore(beforeInstant);
+ conditionsType.setNotOnOrAfter(assertionValidityLength);
+ assertion.setConditions(conditionsType);
+ }
+
+ /**
 * Given an assertion element, validate the signature
 * @param assertionElement
 * @param publicKey the {@link PublicKey}

Deleted:
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/plugins/saml/SAML11TokenProvider.java
===================================================================
---
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/plugins/saml/SAML11TokenProvider.java	2011-07-06
14:45:20 UTC (rev 1067)
+++
federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/plugins/saml/SAML11TokenProvider.java	2011-07-06
15:29:51 UTC (rev 1068)
@@ -1,453 +0,0 @@
-/*
- * JBoss, Home of Professional Open Source. Copyright 2009, Red Hat Middleware LLC, and
individual contributors as
- * indicated by the @author tags. See the copyright.txt file in the distribution for a
full listing of individual
- * contributors.
- * 
- * This is free software; you can redistribute it and/or modify it under the terms of the
GNU Lesser General Public
- * License as published by the Free Software Foundation; either version 2.1 of the
License, or (at your option) any
- * later version.
- * 
- * This software is distributed in the hope that it will be useful, but WITHOUT ANY
WARRANTY; without even the implied
- * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser
General Public License for more
- * details.
- * 
- * You should have received a copy of the GNU Lesser General Public License along with
this software; if not, write to
- * the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301
USA, or see the FSF site:
- * http://www.fsf.org.
- */
-package org.picketlink.identity.federation.core.wstrust.plugins.saml;
-
-import java.net.URI;
-import java.security.Principal;
-import java.security.PrivilegedActionException;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import javax.xml.datatype.XMLGregorianCalendar;
-import javax.xml.namespace.QName;
-
-import org.apache.log4j.Logger;
-import org.picketlink.identity.federation.core.exceptions.ProcessingException;
-import org.picketlink.identity.federation.core.interfaces.ProtocolContext;
-import org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider;
-import org.picketlink.identity.federation.core.saml.v1.SAML11Constants;
-import org.picketlink.identity.federation.core.saml.v2.common.IDGenerator;
-import org.picketlink.identity.federation.core.saml.v2.constants.JBossSAMLConstants;
-import org.picketlink.identity.federation.core.saml.v2.util.AssertionUtil;
-import org.picketlink.identity.federation.core.saml.v2.util.StatementUtil;
-import org.picketlink.identity.federation.core.sts.AbstractSecurityTokenProvider;
-import org.picketlink.identity.federation.core.wstrust.SecurityToken;
-import org.picketlink.identity.federation.core.wstrust.StandardSecurityToken;
-import org.picketlink.identity.federation.core.wstrust.WSTrustConstants;
-import org.picketlink.identity.federation.core.wstrust.WSTrustRequestContext;
-import org.picketlink.identity.federation.core.wstrust.WSTrustUtil;
-import org.picketlink.identity.federation.core.wstrust.wrappers.Lifetime;
-import org.picketlink.identity.federation.saml.v1.assertion.SAML11AssertionType;
-import
org.picketlink.identity.federation.saml.v1.assertion.SAML11AudienceRestrictionCondition;
-import org.picketlink.identity.federation.saml.v1.assertion.SAML11ConditionsType;
-import org.picketlink.identity.federation.saml.v1.assertion.SAML11NameIdentifierType;
-import org.picketlink.identity.federation.saml.v1.assertion.SAML11StatementAbstractType;
-import
org.picketlink.identity.federation.saml.v1.assertion.SAML11SubjectConfirmationType;
-import org.picketlink.identity.federation.saml.v1.assertion.SAML11SubjectType;
-import
org.picketlink.identity.federation.saml.v1.assertion.SAML11SubjectType.SAML11SubjectTypeChoice;
-import org.picketlink.identity.federation.saml.v2.assertion.StatementAbstractType;
-import org.picketlink.identity.federation.ws.policy.AppliesTo;
-import org.picketlink.identity.federation.ws.trust.RequestedReferenceType;
-import org.picketlink.identity.federation.ws.trust.StatusType;
-import org.picketlink.identity.federation.ws.wss.secext.KeyIdentifierType;
-import org.w3c.dom.Element;
-
-/**
- * 
- * A {@code SecurityTokenProvider} implementation that handles WS-Trust SAML 1.1 token
requests.
- * 
- * 
- * @author <a href="mailto:sguilhen@redhat.com">Stefan Guilhen</a>
- */
-public class SAML11TokenProvider extends AbstractSecurityTokenProvider implements
SecurityTokenProvider
-{
- protected static Logger logger = Logger.getLogger(SAML11TokenProvider.class);
-
- private SAML20TokenAttributeProvider attributeProvider;
-
- /*
- * (non-Javadoc)
- * 
- * @see
org.picketlink.identity.federation.core.wstrust.SecurityTokenProvider#initialize(java.util.Map)
- */
- public void initialize(Map<String, String> properties)
- {
- super.initialize(properties);
-
- // Check if an attribute provider has been set.
- String attributeProviderClassName = this.properties.get(ATTRIBUTE_PROVIDER);
- if (attributeProviderClassName == null)
- {
- if (logger.isDebugEnabled())
- logger.debug("No attribute provider set");
- }
- else
- {
- try
- {
- Object object =
SecurityActions.instantiateClass(attributeProviderClassName);
- if (object instanceof SAML20TokenAttributeProvider)
- {
- this.attributeProvider = (SAML20TokenAttributeProvider) object;
- this.attributeProvider.setProperties(this.properties);
- }
- else
- logger.warn("Attribute provider not installed: " +
attributeProviderClassName
- + "is not an instance of SAML20TokenAttributeProvider");
- }
- catch (PrivilegedActionException pae)
- {
- logger.warn("Error instantiating attribute provider: " +
pae.getMessage());
- pae.printStackTrace();
- }
- }
- }
-
- /*
- * (non-Javadoc)
- * 
- * @see org.picketlink.identity.federation.core.wstrust.SecurityTokenProvider#
- * cancelToken(org.picketlink.identity.federation.core.wstrust.WSTrustRequestContext)
- */
- public void cancelToken(ProtocolContext protoContext) throws ProcessingException
- {
- if (!(protoContext instanceof WSTrustRequestContext))
- return;
-
- WSTrustRequestContext context = (WSTrustRequestContext) protoContext;
-
- // get the assertion that must be canceled.
- Element token = context.getRequestSecurityToken().getCancelTargetElement();
- if (token == null)
- throw new ProcessingException("Invalid cancel request: missing required
CancelTarget");
- Element assertionElement = (Element) token.getFirstChild();
- if (!this.isAssertion(assertionElement))
- throw new ProcessingException("CancelTarget doesn't not contain a
SAMLV1.1 assertion");
-
- // get the assertion ID and add it to the canceled assertions set.
- String assertionId = assertionElement.getAttribute(SAML11Constants.ASSERTIONID);
- this.revocationRegistry.revokeToken(SAMLUtil.SAML11_TOKEN_TYPE, assertionId);
- }
-
- /*
- * (non-Javadoc)
- * 
- * @see org.picketlink.identity.federation.core.wstrust.SecurityTokenProvider#
- * issueToken(org.picketlink.identity.federation.core.wstrust.WSTrustRequestContext)
- */
- public void issueToken(ProtocolContext protoContext) throws ProcessingException
- {
- if (!(protoContext instanceof WSTrustRequestContext))
- return;
-
- WSTrustRequestContext context = (WSTrustRequestContext) protoContext;
- // generate an id for the new assertion.
- String assertionID = IDGenerator.create("ID_");
-
- // lifetime and audience restrictions.
- Lifetime lifetime = context.getRequestSecurityToken().getLifetime();
- SAML11AudienceRestrictionCondition restriction = null;
- AppliesTo appliesTo = context.getRequestSecurityToken().getAppliesTo();
- if (appliesTo != null)
- {
- restriction = new SAML11AudienceRestrictionCondition();
- restriction.add(URI.create(WSTrustUtil.parseAppliesTo(appliesTo)));
- }
- SAML11ConditionsType conditions = new SAML11ConditionsType();
- conditions.setNotBefore(lifetime.getCreated());
- conditions.setNotOnOrAfter(lifetime.getExpires());
- conditions.add(restriction);
-
- // the assertion principal (default is caller principal)
- Principal principal = context.getCallerPrincipal();
-
- String confirmationMethod = null;
- //KeyInfoConfirmationDataType keyInfoDataType = null;
-
- Element keyInfo = null;
-
- // if there is a on-behalf-of principal, we have the sender vouches confirmation
method.
- if (context.getOnBehalfOfPrincipal() != null)
- {
- principal = context.getOnBehalfOfPrincipal();
- confirmationMethod = SAMLUtil.SAML11_SENDER_VOUCHES_URI;
- }
- // if there is a proof-of-possession token in the context, we have the holder of
key confirmation method.
- else if (context.getProofTokenInfo() != null)
- {
- confirmationMethod = SAMLUtil.SAML11_HOLDER_OF_KEY_URI;
- //keyInfoDataType =
SAMLAssertionFactory.createKeyInfoConfirmation(context.getProofTokenInfo());
- keyInfo = (Element) context.getProofTokenInfo().getContent().get(0);
- }
- else
- confirmationMethod = SAMLUtil.SAML11_BEARER_URI;
-
- /* SubjectConfirmationType subjectConfirmation =
SAMLAssertionFactory.createSubjectConfirmation(null,
- confirmationMethod, keyInfoDataType);
- */
- SAML11SubjectConfirmationType subjectConfirmation = new
SAML11SubjectConfirmationType();
- subjectConfirmation.addConfirmationMethod(URI.create(confirmationMethod));
- if (keyInfo != null)
- subjectConfirmation.setKeyInfo(keyInfo);
-
- // create a subject using the caller principal or on-behalf-of principal.
- String subjectName = principal == null ? "ANONYMOUS" :
principal.getName();
- SAML11NameIdentifierType nameID = new SAML11NameIdentifierType();
- nameID.setNameQualifier("urn:picketlink:identity-federation");
- nameID.setValue(subjectName);
-
- SAML11SubjectTypeChoice subjectChoice = new SAML11SubjectTypeChoice(nameID);
- SAML11SubjectType subject = new SAML11SubjectType();
- subject.setChoice(subjectChoice);
- subject.setSubjectConfirmation(subjectConfirmation);
-
- // create the attribute statements if necessary.
- List<StatementAbstractType> statements = null;
- Map<String, Object> claimedAttributes = context.getClaimedAttributes();
- if (claimedAttributes != null)
- {
- statements = new ArrayList<StatementAbstractType>();
- statements.add(StatementUtil.createAttributeStatement(claimedAttributes));
- }
- throw new RuntimeException("Implement");
-
- /*
- // create the SAML assertion.
- NameIDType issuerID = SAMLAssertionFactory.createNameID(null, null,
context.getTokenIssuer());
- AssertionType assertion = SAMLAssertionFactory.createAssertion(assertionID,
issuerID, lifetime.getCreated(),
- conditions, subject, statements);
-
- if (this.attributeProvider != null)
- {
- AttributeStatementType attributeStatement =
this.attributeProvider.getAttributeStatement();
- if (attributeStatement != null)
- {
- assertion.addStatement(attributeStatement);
- }
- }
-
- // convert the constructed assertion to element.
- Element assertionElement = null;
- try
- {
- assertionElement = SAMLUtil.toElement(assertion);
- }
- catch (Exception e)
- {
- throw new ProcessingException("Failed to marshall SAMLV2
assertion", e);
- }
-
- SecurityToken token = new
StandardSecurityToken(context.getRequestSecurityToken().getTokenType().toString(),
- assertionElement, assertionID);
- context.setSecurityToken(token);
-
- // set the SAML assertion attached reference.
- KeyIdentifierType keyIdentifier =
WSTrustUtil.createKeyIdentifier(SAMLUtil.SAML11_VALUE_TYPE, "#" + assertionID);
- Map<QName, String> attributes = new HashMap<QName, String>();
- attributes.put(new QName(WSTrustConstants.WSSE11_NS, "TokenType",
WSTrustConstants.WSSE.PREFIX_11),
- SAMLUtil.SAML11_TOKEN_TYPE);
- RequestedReferenceType attachedReference =
WSTrustUtil.createRequestedReference(keyIdentifier, attributes);
- context.setAttachedReference(attachedReference);*/
- }
-
- /*
- * (non-Javadoc)
- * 
- * @see org.picketlink.identity.federation.core.wstrust.SecurityTokenProvider#
- * renewToken(org.picketlink.identity.federation.core.wstrust.WSTrustRequestContext)
- */
- public void renewToken(ProtocolContext protoContext) throws ProcessingException
- {
- if (!(protoContext instanceof WSTrustRequestContext))
- return;
-
- WSTrustRequestContext context = (WSTrustRequestContext) protoContext;
- // get the specified assertion that must be renewed.
- Element token = context.getRequestSecurityToken().getRenewTargetElement();
- if (token == null)
- throw new ProcessingException("Invalid renew request: missing required
RenewTarget");
- Element oldAssertionElement = (Element) token.getFirstChild();
- if (!this.isAssertion(oldAssertionElement))
- throw new ProcessingException("RenewTarget doesn't not contain a
SAMLV1.1 assertion");
-
- // get the JAXB representation of the old assertion.
- SAML11AssertionType oldAssertion = null;
- try
- {
- oldAssertion = SAMLUtil.saml11FromElement(oldAssertionElement);
- }
- catch (Exception je)
- {
- throw new ProcessingException("Error unmarshalling assertion", je);
- }
-
- // canceled assertions cannot be renewed.
- if (this.revocationRegistry.isRevoked(SAMLUtil.SAML11_TOKEN_TYPE,
oldAssertion.getID()))
- throw new ProcessingException("Assertion with id " +
oldAssertion.getID()
- + " has been canceled and cannot be renewed");
-
- // adjust the lifetime for the renewed assertion.
- SAML11ConditionsType conditions = oldAssertion.getConditions();
- 
conditions.setNotBefore(context.getRequestSecurityToken().getLifetime().getCreated());
- 
conditions.setNotOnOrAfter(context.getRequestSecurityToken().getLifetime().getExpires());
-
- // create a new unique ID for the renewed assertion.
- String assertionID = IDGenerator.create("ID_");
-
- List<SAML11StatementAbstractType> statements = new
ArrayList<SAML11StatementAbstractType>();
- statements.addAll(oldAssertion.getStatements());
-
- // create the new assertion.
- XMLGregorianCalendar created =
context.getRequestSecurityToken().getLifetime().getCreated();
-
- SAML11AssertionType newAssertion = AssertionUtil.createSAML11Assertion(assertionID,
created,
- oldAssertion.getIssuer());
- newAssertion.addAllStatements(oldAssertion.getStatements());
-
- // create a security token with the new assertion.
- Element assertionElement = null;
- try
- {
- assertionElement = SAMLUtil.toElement(newAssertion);
- }
- catch (Exception e)
- {
- throw new ProcessingException("Failed to marshall SAMLV2 assertion",
e);
- }
- SecurityToken securityToken = new
StandardSecurityToken(context.getRequestSecurityToken().getTokenType()
- .toString(), assertionElement, assertionID);
- context.setSecurityToken(securityToken);
-
- // set the SAML assertion attached reference.
- KeyIdentifierType keyIdentifier =
WSTrustUtil.createKeyIdentifier(SAMLUtil.SAML11_VALUE_TYPE, "#" + assertionID);
- Map<QName, String> attributes = new HashMap<QName, String>();
- attributes.put(new QName(WSTrustConstants.WSSE11_NS, "TokenType"),
SAMLUtil.SAML11_TOKEN_TYPE);
- RequestedReferenceType attachedReference =
WSTrustUtil.createRequestedReference(keyIdentifier, attributes);
- context.setAttachedReference(attachedReference);
- }
-
- /*
- * (non-Javadoc)
- * 
- * @see org.picketlink.identity.federation.core.wstrust.SecurityTokenProvider#
- *
validateToken(org.picketlink.identity.federation.core.wstrust.WSTrustRequestContext)
- */
- public void validateToken(ProtocolContext protoContext) throws ProcessingException
- {
- if (!(protoContext instanceof WSTrustRequestContext))
- return;
-
- WSTrustRequestContext context = (WSTrustRequestContext) protoContext;
- if (logger.isTraceEnabled())
- logger.trace("SAML V2.0 token validation started");
-
- // get the SAML assertion that must be validated.
- Element token = context.getRequestSecurityToken().getValidateTargetElement();
- if (token == null)
- throw new ProcessingException("Bad validate request: missing required
ValidateTarget");
-
- String code = WSTrustConstants.STATUS_CODE_VALID;
- String reason = "SAMLV2.0 Assertion successfuly validated";
-
- SAML11AssertionType assertion = null;
- Element assertionElement = (Element) token.getFirstChild();
- if (!this.isAssertion(assertionElement))
- {
- code = WSTrustConstants.STATUS_CODE_INVALID;
- reason = "Validation failure: supplied token is not a SAMLV2.0
Assertion";
- }
- else
- {
- try
- {
- assertion = SAMLUtil.saml11FromElement(assertionElement);
- }
- catch (Exception e)
- {
- throw new ProcessingException("Unmarshalling error:", e);
- }
- }
-
- // check if the assertion has been canceled before.
- if (this.revocationRegistry.isRevoked(SAMLUtil.SAML11_TOKEN_TYPE,
assertion.getID()))
- {
- code = WSTrustConstants.STATUS_CODE_INVALID;
- reason = "Validation failure: assertion with id " + assertion.getID()
+ " has been canceled";
- }
-
- // check the assertion lifetime.
- try
- {
- if (AssertionUtil.hasExpired(assertion))
- {
- code = WSTrustConstants.STATUS_CODE_INVALID;
- reason = "Validation failure: assertion expired or used before its
lifetime period";
- }
- }
- catch (Exception ce)
- {
- code = WSTrustConstants.STATUS_CODE_INVALID;
- reason = "Validation failure: unable to verify assertion lifetime: " +
ce.getMessage();
- }
-
- // construct the status and set it on the request context.
- StatusType status = new StatusType();
- status.setCode(code);
- status.setReason(reason);
- context.setStatus(status);
- }
-
- /**
- * 
- * Checks whether the specified element is a SAMLV2.0 assertion or not.
- * 
- * 
- * @param element
- * the {@code Element} being verified.
- * @return {@code true} if the element is a SAMLV2.0 assertion; {@code false}
otherwise.
- */
- private boolean isAssertion(Element element)
- {
- return element == null ? false :
"Assertion".equals(element.getLocalName())
- &&
SAML11Constants.ASSERTION_11_NSURI.equals(element.getNamespaceURI());
- }
-
- /**
- * @see {@code SecurityTokenProvider#supports(String)}
- */
- public boolean supports(String namespace)
- {
- return WSTrustConstants.BASE_NAMESPACE.equals(namespace);
- }
-
- /**
- * @see
org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#tokenType()
- */
- public String tokenType()
- {
- return SAMLUtil.SAML11_TOKEN_TYPE;
- }
-
- /**
- * @see
org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#getSupportedQName()
- */
- public QName getSupportedQName()
- {
- return new QName(tokenType(), JBossSAMLConstants.ASSERTION.get());
- }
-
- /**
- * @see
org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#family()
- */
- public String family()
- {
- return SecurityTokenProvider.FAMILY_TYPE.WS_TRUST.toString();
- }
-}
\ No newline at end of file

Modified: federation/trunk/picketlink-fed-core/src/main/resources/core-sts.xml
===================================================================

--- federation/trunk/picketlink-fed-core/src/main/resources/core-sts.xml	2011-07-06
14:45:20 UTC (rev 1067)
+++ federation/trunk/picketlink-fed-core/src/main/resources/core-sts.xml	2011-07-06
15:29:51 UTC (rev 1068)
@@ -5,7 +5,7 @@
             TokenType="urn:oasis:names:tc:SAML:2.0:assertion"
 	        TokenElement="Assertion"
 	        TokenElementNS="urn:oasis:names:tc:SAML:2.0:assertion"/>
-	    <TokenProvider
ProviderClass="org.picketlink.identity.federation.core.wstrust.plugins.saml.SAML11TokenProvider"
+	    <TokenProvider
ProviderClass="org.picketlink.identity.federation.core.saml.v1.providers.SAML11AssertionTokenProvider"
             TokenType="urn:oasis:names:tc:SAML:1.0:assertion"
 	        TokenElement="Assertion"
 	        TokenElementNS="urn:oasis:names:tc:SAML:1.0:assertion"/>


    

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

[picketlink-commits] Picketlink SVN: r1068 - in federation/trunk/picketlink-fed-core/src/main: java/org/picketlink/identity/federation/core/saml/v1/providers and 3 other directories.